Repository navigation
chore(deps): bump actions/setup-node from 6.3.0 to 7.0.0 - #3549
MohammadHaroonAbuomar merged 3 commits into
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6.3.0...8207627) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
the
dependencies
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
PR Review Summary
Verdict: AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims. |
github-actions
Bot
added
size/S
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates GitHub Actions workflows to use the newer actions/setup-node action release.
Changes:
- Bump
actions/setup-nodefrom v6.x to v7.0.0 in multiple workflows - Keep actions pinned to a specific commit SHA while updating the referenced version
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/sync-atr-community-rules.yml | Updates actions/setup-node pin to v7.0.0 |
| .github/workflows/publish.yml | Updates actions/setup-node pin to v7.0.0 for publish matrix |
| .github/workflows/policy-engine-ci.yml | Updates actions/setup-node pin to v7.0.0 for CI job |
| .github/workflows/ci.yml | Updates actions/setup-node pin to v7.0.0 in CI jobs |
MohammadHaroonAbuomar
changed the title
Dependabot bumped the generated policy-engine-ci.yml but not the .github/ci/actions.toml source of truth, so 'Check generated workflows' and the inline-script tests failed. Update the registry pin to the same v7.0.0 commit and regenerate (a no-op now that the registry matches dependabot's edit). Signed-off-by: MohammadHaroonAbuomar <40180927+MohammadHaroonAbuomar@users.noreply.github.com>
MohammadHaroonAbuomar
left a comment
MohammadHaroonAbuomar
left a comment
There was a problem hiding this comment.
Major reviewed per policy: pinned SHA 82076278 dereferences to the v7.0.0 tag; breaking changes (ESM/node24 runtime, dummy NODE_AUTH_TOKEN removal) do not apply to our usage (node-version/registry-url inputs only; publish.yml sets NODE_AUTH_TOKEN explicitly; all jobs GitHub-hosted); release 17 days old. Pushed 88c08ae syncing the .github/ci/actions.toml pin registry, which dependabot cannot edit, and regenerating (no-op once the registry matches) - this was the cause of the Check-generated-workflows and inline-script-tests failures.
MohammadHaroonAbuomar
left a comment
MohammadHaroonAbuomar
left a comment
There was a problem hiding this comment.
Re-approving at the merge-from-main head: the actions.toml v7.0.0 registry sync is intact at this head and the earlier verification (SHA=tag, no applicable breaking changes, 17-day-old release) carries. The branch update was pushed by the maintainer, so last-push-approval is satisfied by this review.
Bumps actions/setup-node from 6.3.0 to 7.0.0.
Release notes
Sourced from actions/setup-node's releases.
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)